COconductorone
Workload Federation

Create Trust

Changed on

CreateTrust creates a trust policy for a service principal. Validates the CEL condition_expression at creation time.

post/api/v1/service_principals/{service_principal_id}/trusts

Request

  • Base URL
    https://example.conductor.one
  • URL
    https://example.conductor.one/api/v1/service_principals/{service_principal_id}/trusts
  • Auth
    HTTP bearer and OAuth 2
    Client credentials
    Token URL: /auth/v1/token

Path parameters

service_principal_idstring required

The service principal ID to create the trust for (from URL path).

Request body

allowSourceCidrsstring[] nullable

IP allowlist for token exchange requests matching this trust. Accepts IPv4 (e.g. 10.0.0.0/24) or IPv6 (e.g. 2001:db8::/32) CIDRs.

conditionExpressionstring

CEL expression evaluated against JWT claims. Must return bool. Compiled and validated before storage.

descriptionstring

A description of what this trust policy matches.

displayNamestring

The display name for the trust.

passthroughClaimsstring[] nullable

JWT claim names from the subject token to copy into the issued C1 token.

providerIdstring

The provider this trust references.

scopedRoleIdsstring[] nullable

Scoped role IDs. Effective permissions = min(SP roles, trust.scoped_role_ids).

Response

Successful response

Changes

  • 918a4e749f56Revision changes
    • info

      added the optional property // to the response with the status

  • f2cf3228f366Revision changes
    • breaking

      the request property became not nullable

    • breaking

      the request property became not nullable

    • breaking

      the request property became not nullable

    • breaking

      added subschema #2 to the response property oneOf list for the response status

    • breaking

      the response's property type changed from object to no type for status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status

    • warning

      removed the optional property / from the response with the status